Title: [285978] trunk
- Revision
- 285978
- Author
- [email protected]
- Date
- 2021-11-17 21:01:47 -0800 (Wed, 17 Nov 2021)
Log Message
[JSC] TypedArray GetArrayLength should not use Reuse
https://bugs.webkit.org/show_bug.cgi?id=233299
rdar://85502079
Reviewed by Robin Morisset.
JSTests:
* stress/get-array-length-reuse.js: Added.
(foo):
Source/_javascript_Core:
We should not perform OSR exit after assigning a value to a reused register, otherwise,
OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
OSR exit after loading a length, so we should not use reused register for length.
* dfg/DFGSpeculativeJIT.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (285977 => 285978)
--- trunk/JSTests/ChangeLog 2021-11-18 04:04:13 UTC (rev 285977)
+++ trunk/JSTests/ChangeLog 2021-11-18 05:01:47 UTC (rev 285978)
@@ -1,3 +1,14 @@
+2021-11-17 Yusuke Suzuki <[email protected]>
+
+ [JSC] TypedArray GetArrayLength should not use Reuse
+ https://bugs.webkit.org/show_bug.cgi?id=233299
+ rdar://85502079
+
+ Reviewed by Robin Morisset.
+
+ * stress/get-array-length-reuse.js: Added.
+ (foo):
+
2021-11-17 Saam Barati <[email protected]>
Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
Added: trunk/JSTests/stress/get-array-length-reuse.js (0 => 285978)
--- trunk/JSTests/stress/get-array-length-reuse.js (rev 0)
+++ trunk/JSTests/stress/get-array-length-reuse.js 2021-11-18 05:01:47 UTC (rev 285978)
@@ -0,0 +1,12 @@
+function foo(a) {
+ arguments;
+ a.length;
+}
+
+let x = new Uint8Array();
+for (let i = 0; i < 10000; ++i)
+ foo(x);
+
+try {
+ foo(new Uint8Array(2**31));
+} catch { }
Modified: trunk/Source/_javascript_Core/ChangeLog (285977 => 285978)
--- trunk/Source/_javascript_Core/ChangeLog 2021-11-18 04:04:13 UTC (rev 285977)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-11-18 05:01:47 UTC (rev 285978)
@@ -1,3 +1,17 @@
+2021-11-17 Yusuke Suzuki <[email protected]>
+
+ [JSC] TypedArray GetArrayLength should not use Reuse
+ https://bugs.webkit.org/show_bug.cgi?id=233299
+ rdar://85502079
+
+ Reviewed by Robin Morisset.
+
+ We should not perform OSR exit after assigning a value to a reused register, otherwise,
+ OSR exit cannot recover the proper value. Now TypedArray GetArrayLength can perform
+ OSR exit after loading a length, so we should not use reused register for length.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+
2021-11-17 Saam Barati <[email protected]>
Run the memmove fast path in JSGenericTypedArrayView<Adaptor>::set when using a combination of Uint8 and Uint8Clamped
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (285977 => 285978)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-11-18 04:04:13 UTC (rev 285977)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2021-11-18 05:01:47 UTC (rev 285978)
@@ -8661,7 +8661,7 @@
default: {
ASSERT(node->arrayMode().isSomeTypedArrayView());
SpeculateCellOperand base(this, node->child1());
- GPRTemporary result(this, Reuse, base);
+ GPRTemporary result(this);
GPRReg baseGPR = base.gpr();
GPRReg resultGPR = result.gpr();
#if USE(LARGE_TYPED_ARRAYS)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
